Stored memory recovery system

ABSTRACT

Various embodiments of systems and methods for preserving saved memory states to which a computer system can be restored are disclosed. In certain embodiments, the systems and methods intercept write operations to protected memory locations and redirect them to alternate memory locations. Embodiments of the systems and methods include creation of a table for each memory state. Certain embodiments additionally include a recovery capability, by which the protected memory in the computer system is capable of being restored or recovered to a recovery point that represents a saved memory state. Further embodiments relate to systems and methods for preventing protected memory locations from being overwritten that utilize a plurality of memory state values.

RELATED APPLICATIONS

[0001] This application is a continuation-in-part of, and claimspriority to, U.S. patent application Ser. No. 09/420,348, filed Oct. 19,1999 and titled “OPERATING SYSTEM AND DATA PROTECTION,” which is herebyincorporated by reference in its entirety. This application also claimspriority under 35 U.S.C. 119(e) to U.S. Provisional Application No.60/424,356, filed Nov. 5, 2002 and titled “STORED MEMORY RECOVERYSYSTEM,” and U.S. Provisional Application No. 60/459,927, filed Mar. 31,2003 and titled “STORED MEMORY RECOVERY SYSTEM,” which are herebyincorporated by reference in their entireties. This application isrelated to U.S. patent application Ser. No. 09/617,338, filed Jul. 17,2000 and titled “OPERATING SYSTEM AND DATA PROTECTION,” which is herebyincorporated by reference in its entirety.

BACKGROUND OF THE INVENTION FIELD OF THE INVENTION

[0002] The present invention generally relates to computer systems. Moreparticularly, the present invention relates to systems and methods forpreserving prior states of protected memory to which computer systemscan be restored.

DESCRIPTION OF THE RELATED TECHNOLOGY

[0003] Programs presently exist for backing up data from an area ofmemory to another area of memory or to an auxiliary storage device.These programs typically operate by physically copying entire computerfiles or incremental changes to data stored in files, typically afterchanges are made to the files or at certain predetermined timeintervals. Some of these programs allow for the backing up and restoringof the computer operating system. Sometimes, the user performs somemodification of a computer file or the operating system that causescorruption of the file or catastrophic operating system failure of thecomputing system. When this occurs, the file or operating system wouldbe rendered unusable and unrecoverable.

[0004] One example of this involves a user performing some undesirablemodification of the operating system that disables the computing systemand prevents its operation. Another example is when a user desires to“clean up” certain portions of the hard disk of the computing system. Inthis situation, the user may delete certain files within the hard diskwithout a great deal of caution or knowledge as to the consequences ofthe changes being made. A further example is when a computer applicationprogram itself erroneously corrupts data files or operating system data.

[0005] Many existing programs for backing up and restoring data consumesignificant computing system resources, for example, processor cycles,memory usage, or disk storage. These systems typically save and restoredata by copying from one location to another. Even if the saving of thedata is done during times of low utilization of the computer system,e.g., during the evening or during the user's lunch break, therestoration can nonetheless be slow and cumbersome due to having to copydata from the backup storage area to the original storage area.

[0006] Therefore, what is needed is a system and method that preservesprotected memory in a manner that is transparent to the user, thatincludes multiple recovery points and that does not consume significantcomputer system resources. The system and method would also maintain themultiple recovery points by creating and managing one or more tables,e.g., matrix tables, so that restoring the computer system to a previousrecovery state would be accomplished in a very fast and efficient mannerthat does not require the copying of preserved data from one memorylocation to another.

[0007] Further limitations and disadvantages of conventional andtraditional systems will become apparent to one of skill in the artthrough comparison of such systems with the present invention as setforth in the remainder of the present application with reference to thedrawings.

SUMMARY OF CERTAIN INVENTIVE ASPECTS

[0008] The systems and methods of the invention have several features,no single one of which is solely responsible for its desirableattributes. Without limiting the scope of the invention as expressed bythe claims that follow, its more prominent features will now bediscussed briefly. After considering this discussion, and particularlyafter reading the section entitled “Detailed Description of CertainEmbodiments” one will understand how the features of the system andmethods provide several advantages over traditional systems.

[0009] One aspect is a method of recovery to one or more previous memorystates in a computer system having a memory, the method comprisingreceiving a write request to a first memory location, determiningwhether said first memory location contains protected data, redirectingsaid write request to a second memory location if said first memorylocation contains protected data, thereby preserving the contents of thefirst memory location for a first recovery, and redirecting a subsequentwrite request to said second memory location to a third memory location,thereby preserving the contents of said second memory location for asecond recovery.

[0010] This additionally comprises redirecting a read request to saidfirst memory location to said second memory location, thereby returningthe contents of said second memory location in response to said readrequest to said first memory location. This further comprisesredirecting a read request to said second memory location to said thirdmemory location, thereby returning the contents of said third memorylocation in response to said read request to said second memorylocation. This additionally comprises the above method wherein thememory is accessed via a network. Additionally, this comprises the abovemethod wherein the memory is a disk drive and the memory states arestates of the disk drive. This additionally comprises the above methodwherein the disk drive is accessed via a network.

[0011] This further comprises the above method wherein the protecteddata contained in the first memory location is operating system data ofthe computer system. In addition, this comprises the above methodwherein the first and second recovery points represent one or moreconfigurations of the computer system. This additionally comprises theabove method wherein said first and second recovery points areconfiguration states, memory states, recovery states, sector states, orcomputer states.

[0012] An additional aspect is a method of recovery to one or moreprevious memory states in a computer system having a memory, the methodcomprising selecting a first addressable memory location as part of afirst recovery point, receiving a write request to said firstaddressable memory location, redirecting said write request to a secondaddressable memory location, selecting said second addressable memorylocation as part of a second recovery point, and redirecting asubsequent write request to said second addressable memory location to athird addressable memory location.

[0013] This additionally comprises redirecting a read request to saidfirst addressable memory location to said second addressable memorylocation, thereby returning the contents of said second addressablememory location in response to said read request to said firstaddressable memory location. This further comprises redirecting a readrequest to said second addressable memory location to said thirdaddressable memory location, thereby returning the contents of saidthird addressable memory location in response to said read request tosaid second addressable memory location.

[0014] An additional aspect is a method of protecting one or more memorylocations from being overwritten, the method comprising creating a tableof a status of at least one memory location, receiving a write requestto a first memory location, determining if said first memory locationcontains protected data from a status of said first memory location insaid table, redirecting said write request to a second memory locationif said first memory location contains protected data, indicating astatus of said second memory location in said table that said secondmemory location contains protected data, redirecting a write request tosaid second memory location to a third memory location, and indicating astatus of said third memory location in said table that said thirdmemory location contains protected data.

[0015] This additionally comprises redirecting a read request to saidfirst memory location to said second memory location, thereby returningthe contents of said second memory location in response to said readrequest to said first memory location. This further comprisesredirecting a read request to said second memory location to said thirdmemory location, thereby returning the contents of said third memorylocation in response to said read request to said second memorylocation.

[0016] This additionally comprises the above method wherein the one ormore memory locations are accessed via a network. This further comprisesthe above method wherein the one or more memory locations are locationson a disk drive. This also comprises the above method wherein the diskdrive is accessed via a network.

[0017] An additional aspect is a method of restoring a computer systemto a previous memory state, the method comprising designating at leastone memory location as recovery data associated with a first recoverypoint, redirecting write requests to said at least one memory locationto another memory location, and recovering to said first recovery pointby designating said at least one memory location and said another memorylocation as recovery data associated with a second recovery point.

[0018] This additionally comprises the above method wherein the memorylocations are accessed via a network. This further comprises the abovemethod wherein the memory locations are locations on a disk drive. Thisalso comprises the above method wherein the disk drive is accessed via anetwork.

[0019] An additional aspect is a computer operating system configured topreserve protected memory locations that reside on a computer system andrecover to one or more recovery points that represent a previous stateof said protected memory locations, the computer operating systemcomprising a table containing data indicating the status of saidprotected memory locations, wherein said table is initialized toindicate an original state of said protected memory locations and adriver configured to receive a write request to a first memory location,determine whether said first memory location is a protected memorylocation, if said first memory location is a protected memory location,find a second memory location that has a status of not used, update saidtable to indicate a used status of said second memory location, redirectsaid write request from said first memory location to said second memorylocation, and update said table to indicate a redirected status of saidfirst memory location to said second memory location.

[0020] This additionally comprises the above computer operating systemwherein the driver is further configured to redirect a read request tosaid first memory location to said second memory location, therebyreturning the contents of said second memory location in response tosaid read request to said first memory location. This further comprisesthe above computer operating system wherein the driver is furtherconfigured to receive a write request to said second memory location,determine whether said second memory location is a protected memorylocation, if said second memory location is a protected memory location,find a third memory location that has a status of unused, update saidtable to indicate a used status of said third memory location, redirectsaid write request from said second memory location to said third memorylocation, and update said table to indicate a redirected status of saidsecond memory location to said third memory location.

[0021] This additionally comprises the above computer operating systemwherein the driver is further configured to redirect a read request tosaid second memory location to said third memory location, therebyreturning the contents of said third memory location in response to saidread request to said second memory location. This further comprises theabove computer operating system wherein the memory locations areaccessed via a network. This also comprises the above computer operatingsystem wherein the memory locations are locations on a disk drive. Thisadditionally comprises the above computer operating system wherein thedisk drive is accessed via a network.

[0022] An additional aspect is a method of preserving protected memorylocations that reside on a computer system and recovering to one or morerecovery points that represent a previous state of said protected memorylocations, the method comprising initializing a table containing dataindicating the status of said protected memory locations to indicate anoriginal state of said protected memory locations, receiving a writerequest to a first memory location, determining whether said firstmemory location is a protected memory location, if said first memorylocation is a protected memory location, finding a second memorylocation that has a status of not used, updating said table to indicatea used status of said second memory location, redirecting said writerequest from said first memory location to said second memory location,and updating said table to indicate a redirected status of said firstmemory location to said second memory location.

[0023] This additionally comprises redirecting a read request to saidfirst memory location to said second memory location, thereby returningthe contents of said second memory location in response to said readrequest to said first memory location. This further comprises receivinga write request to said second memory location, determining whether saidsecond memory location is a protected memory location, if said secondmemory location is a protected memory location, finding a third memorylocation that has a status of unused, updating said table to indicate aused status of said third memory location, redirecting said writerequest from said second memory location to said third memory location,and updating said table to indicate a redirected status of said secondmemory location to said third memory location.

[0024] This further comprises redirecting a read request to said secondmemory location to said third memory location, thereby returning thecontents of said third memory location in response to said read requestto said second memory location. This additionally comprises the abovemethod wherein the memory locations are accessed via a network.

[0025] An additional aspect is a method of creating a plurality oftables in a computer system having protected memory locations, saidplurality of tables representing a plurality of recovery points thatrepresent previous states of said protected memory locations, the methodcomprising creating an initial table indicating an original state ofsaid protected memory locations, identifying a new recovery pointrepresenting a new state of said protected memory locations to bepreserved, creating a new table corresponding to said new recoverypoint, wherein said new table is a copy of said initial table, comparingsaid new table to a most recently created previous table, and if saidnew table indicates an unused status for one or more memory locationsfor which corresponding memory locations of said previous table indicatea used status, updating said new table to indicate a status of protectedfor said one or more memory locations.

[0026] This additionally comprises the above method wherein the memorylocations are accessed via a network. This further comprises the abovemethod wherein the memory locations are locations on a disk drive. Thisalso comprises the above method wherein the disk drive is accessed via anetwork.

[0027] An additional aspect is a computer readable storage medium havingstored thereon instructions that when executed by a computer processorperform a method of recovery to one or more previous memory states in acomputer system having a memory, the method comprising receiving a writerequest to a first memory location, determining whether said firstmemory location contains protected data, redirecting said write requestto a second memory location if said first memory location containsprotected data, thereby preserving the contents of the first memorylocation for a first recovery, and redirecting a subsequent writerequest to said second memory location to a third memory location,thereby preserving the contents of said second memory location for asecond recovery.

[0028] This additionally comprises the above computer readable storagemedium, wherein the method further comprises redirecting a read requestto said first memory location to said second memory location, therebyreturning the contents of said second memory location in response tosaid read request to said first memory location.

BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above and other aspects, features and advantages of theinvention will be better understood by referring to the followingdetailed description, which should be read in conjunction with theaccompanying drawings. These drawings and the associated description areprovided to illustrate certain embodiments of the invention, and not tolimit the scope of the invention.

[0030]FIG. 1 is a block diagram illustrating embodiments of thecomponents or modules of a computer system with a sector managementsystem.

[0031]FIG. 2 is a diagram illustrating the relationship between files,clusters and sectors in a file system such as FAT16 or FAT32.

[0032]FIG. 3 is a diagram illustrating a simplified representation of 12sectors, labeled A-L, of a hard disk.

[0033]FIG. 4 is a diagram illustrating the sectors of FIG. 3 after theIdentify_Module has identified a set of recovery data.

[0034]FIG. 5 is a diagram illustrating a representation of a matrixtable, e.g., matrix table 1, associated with the recovery data set 1discussed above with regard to FIG. 4.

[0035]FIG. 6 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom the file system to a sector flagged as Already_Used.

[0036]FIG. 7 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom the file system to a sector flagged as RS_Free.

[0037]FIG. 8 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom file system to a sector flagged as RS_Used.

[0038]FIG. 9 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom the file system to a sector flagged as Newly_Used.

[0039]FIG. 10 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom file system to a sector flagged as Current_Redirected.

[0040]FIG. 11 is a diagram illustrating a representation of theaforementioned 12 sectors that indicates a new recovery data set, e.g.,recovery data set 2, identified at a new recovery point, e.g., recoverypoint 2.

[0041]FIG. 12 is a diagram illustrating an embodiment of a second matrixtable, e.g., matrix table 2, corresponding to recovery data set 2 ofFIG. 11.

[0042]FIG. 13 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom file system to a sector flagged as Previous_Redirected, withrespect to matrix table 2 shown in FIG. 12.

[0043]FIG. 14 is a diagram illustrating a representation of the 12 harddisk sectors with two identified recovery data sets.

[0044]FIG. 15 is a diagram illustrating an embodiment of thecorresponding changes to the working version of matrix table 2 made bythe Writes_Module after redirecting to sector I a write request from thefile system to sector H as discussed above with regard to FIG. 14.

[0045]FIG. 16 is a diagram illustrating a representation of a newrecovery data set, e.g., recovery data set 3, identified by theIdentify_Module at recovery point 3.

[0046]FIG. 17 is a diagram illustrating an embodiment of a new matrixtable, e.g., matrix table 3, created by the Identify_Module.

[0047]FIG. 18 is a diagram illustrating a further representation of the12 hard disk sectors with three identified recovery data sets.

[0048]FIG. 19 is a diagram illustrating an embodiment of arepresentation of the working version of matrix table 3 after theWrites_Module processes the write request to sector J.

[0049]FIG. 20 is a diagram illustrating an embodiment of an overview ofthe newly identified recovery data set, e.g., recovery data set 4.

[0050]FIG. 21 is a flowchart illustrating an embodiment of a processperformed by the Recover_Module to restore the hard disk to a statereflected by a previously identified recovery data set.

[0051]FIG. 22 is a diagram illustrating in greater detail an embodimentof a process, matrix tables and sector representations associated withthe embodiment shown in FIG. 20, with the Recover_Module performing theprocess as discussed above with regard to FIG. 21.

[0052]FIG. 23 is a diagram illustrating an embodiment of a process,matrix tables and sector representations in which the Recover_Modulecreates recovery point 5 to restore to recovery point 3 after creatingrecovery point 4 to recover to recovery point 1 as shown in FIG. 22.

DETAILED DESCRIPTION OF CERTAIN EMBODIMENTS

[0053] The following detailed description is directed to certainspecific embodiments of the invention. However, the invention can beembodied in a multitude of different ways as defined and covered by theclaims. The scope of the invention is to be determined with reference tothe appended claims. In this description, reference is made to thedrawings wherein like parts are designated with like numeralsthroughout.

[0054] The sector management system may be comprised of variouscomponents or modules that perform the functionality as described indetail below. The components or modules may comprise various softwaresub-routines, procedures, definitional statements and macros. Each ofthe components or modules are typically separately compiled and linkedinto a single executable program. Therefore, reference to components ormodules in the following description is used for convenience to describethe functionality of embodiments of the system. Thus, the processes thatare undergone by each of the components or modules may be arbitrarilyredistributed to one of the other components or modules, combinedtogether in a single components or module, or made available in, forexample, a shareable dynamic link library.

[0055] In certain embodiments, these components or modules may beconfigured to reside on the addressable storage medium of a computersystem and configured to execute on a processor, or on multipleprocessors. The components or modules include, but are not limited to,software or hardware components that perform certain tasks. Thus, acomponent or module may include, by way of example, software components,object-oriented software components, class components and taskcomponents, processes, functions, attributes, procedures, subroutines,segments of program code, drivers, firmware, microcode, circuitry, data,databases, data structures, tables, arrays, and variables. Furthermore,the functionality provided for in the components or modules may becombined into fewer components, modules, or databases or furtherseparated into additional components, modules, or databases.Additionally, the components or modules may be implemented to execute ona computer, or on multiple computers.

[0056] The sector management system is capable of protecting selecteddata stored in a computer system so that the computer system can berestored to the state represented by the protected data. Another aspectof the sector management system allows the computer system to berestored to more than one state. In some embodiments, data is protectedfrom being overwritten by redirecting write requests to other locations.

[0057] The sector management system may be implemented utilizing varioustypes of memory storage, e.g., computer memory devices (such as RandomAccess Memory, or RAM), removable storage, local hard disks and memorystorage that is accessed via hard disks located remotely and accessedvia a network. In other embodiments, the sector management system isimplemented utilizing firmware, software (e.g., programs or data) storedin non-volatile memory such as read-only memory (ROM). Types of ROMinclude, for example, programmable read-only memory (PROM), erasableprogrammable read-only memory (EPROM), electrically erasableprogrammable read-only memory (EEPROM), and flash memory. For ease ofexplanation, the sector management system is described below in terms ofthe local hard disk embodiments.

[0058] The sector management system as described herein utilizes atable, for example, a matrix table or a file allocation table (FAT), forthe storage and retrieval of sector state data. However, in otherembodiments, the sector management system may utilize different ways ofstoring and retrieving sector state data, for example, using analgorithmic approach, static or dynamic linking techniques, or othertypes of tables or data storage schemes for storing and retrievingsector state data. The table for storing the sector state may be storedon any of a number of storage devices, for example, a mass storagedevice such as a hard drive, a memory device, or even split acrossmultiple devices, such as a Redundant Array of Independent Disks (RAID)system.

[0059] As used herein, the terms memory state, recovery data, recoverypoint, recovery state, sector state, configuration, system or softwareconfiguration, or personal computer (PC) state, may be used essentiallyinterchangeably herein to refer to the data associated with a particularstate, configuration or status of the computer system or storage device.In some embodiments, the recovery point may include the operating systemof the computer system, and the operating system may have storagetables, for example, a file allocation table (FAT), which refers to atable the operating system uses to locate files on a disk device. Thus,each recovery point or sector state can itself act as a separate andindependent operating system.

[0060] In other embodiments, recovery points represent system orsoftware configurations. System or software configurations can refer toversions of the operating system, operating environment, applicationsoftware programs, utility software programs, or data used by any ofthese. These embodiments are described below following the descriptionof the figures.

[0061] While the systems and methods described herein have many mannersof use and implementation, the following describes various embodimentsin terms of a recovery system for illustrative purposes only. However,as would be understood by those skilled in the technology, otherembodiments of the sector management system, for example, restoration orreversion systems, configuration management systems, and securitysystems, could also be implemented using the systems and methods asdescribed herein.

[0062]FIG. 1 is a block diagram illustrating embodiments of thecomponents or modules of a computer system 10 with a sector managementsystem 150. However, it should be understood that modules representedherein as software may also be implemented as hardware, for example, asan application-specific integrated circuit (ASIC). The computer system10 may be one of a number of microprocessor or processor controlleddevices, for example, personal computers, workstations, servers,clients, mini computers, main-frame computers, laptop computers, anetwork of individual computers, mobile computers, palm-top computers,hand-held computers, set top boxes for a television, other types ofweb-enabled televisions, interactive kiosks, personal digitalassistants, interactive or web-enabled wireless communications devices,mobile web browsers, or a combination thereof. The computers may furtherpossess input devices such as a keyboard, mouse, touchpad, touch screen,joystick, pen-input-pad, and the like. The computers may also possess anoutput device, such as a screen or other visual conveyance means and aspeaker or other type of audio conveyance means.

[0063] The computer system 10 is generally controlled by an operatingsystem 100, such as DOS, Windows, Macintosh OS, OS/2, Linux, or others.A key part of many operating systems 100 is a file system 102, withwhich the operating system 100 manages and stores files. Files refer notonly to user data, but also to any of the files on the computerincluding, for example, program files and configuration files. Examplesof file systems 102 include FAT16, FAT32 and Microsoft NT file system(NTFS). Generally the file system 102 has an index 104 to track thelocations of files in the memory of the computer system. For example,the FAT16 and the FAT32 file systems use the file allocation table (FAT)to keep track of files.

[0064] The operating system 100 may also include one or more devicedrivers, collectively identified as 106 in FIG. 1, which enablecommunication with hardware devices, such as a hard disk 114. Oneexample of a device driver is the real mode input/output (I/O) driver108 (IO.SYS) in DOS and DOS-based versions of Windows. The real mode I/Odriver 108 generally relies on the BIOS (basic input/output system) 110to communicate with the hard disk 114, as explained below. The BIOS 110handles read and write requests to the hard disk 114.

[0065] Another component of the system shown in FIG. 1 is the hard disk114. While embodiments as shown in FIG. 1 illustrate the hard disk 114being located internal to the computer system 10 from which the recoverypoint storage or retrieval is being initiated, other embodiments may beutilized in which the hard disk 114 is located external to the computersystem 10. As an example, the hard disk 114 may alternatively be astorage device that is located on another computer system that isaccessible via a computer network 30. The network 30 could be, forexample, an Ethernet network in which distributed servers having a harddisk or other storage device are connected to the network 30, and areaccessible to the other devices on the network. Thus, storage andretrieval of recovery data, as described in detail below, could bedirected to a local storage device, such as the hard disk 114 (as shownin FIG. 1), or to a remote storage device (not shown) accessible via thenetwork 30.

[0066] The network 30 may implement virtual private network (VPN)capabilities. A VPN can be a secure and encrypted communications linkbetween nodes on a network, for example, the Internet, a Wide AreaNetwork (WAN), a Local Area Network (LAN), or an Intranet. These nodescan communicate with each other. However, it is very difficult for anunauthorized user, for example, a hacker, to either comprehend themeaning of the signals or send signals that are believed to beauthentic. One secure communications technology that is designed tofacilitate a VPN is Secure Sockets Layer (SSL). Other securecommunications technologies can be used as well.

[0067] A VPN can operate between a number of internet-enabled devices.For example, a VPN can run on two or more PCs that are connectedtogether using various security technologies. In other embodiments, aVPN can operate between a PC and a website using security technologies.In further embodiments, a VPN can additionally operate between many PCsand/or many websites. For example, hand-held devices such as personaldigital assistants (PDAs), wireless devices such as mobile or cellphones, web-enabled TV sets can also be used as client devices insteadof PCs as part of the VPN.

[0068] In some computer systems, the smallest addressable unit on thehard disk 114 is the sector. However, in both FAT16 and FAT32, two verycommon file systems 102, the smallest addressable memory allocation uniton a hard disk is the cluster, which is an integer multiple number ofsectors. In an operating system 100 with such file systems, the realmode I/O driver 108 also functions in units of clusters. In the FAT16and FAT32 file systems, each file is stored in one or more clusters,with each file occupying an integer multiple number of clusters. Thefile system 102 tracks the location of each file by noting the addressof the first cluster storing a file (e.g., the starting cluster) in itsindex 104 (FAT). If a file is larger than one cluster, thus occupyingmore than one cluster, a pointer is provided at the end of each cluster,except the last one, pointing to the next cluster in which part of thefile is stored. In still other embodiments, other addressable unitsbesides clusters and sectors are utilized, and such embodiments are alsowithin the scope of the present invention.

[0069] The computer system 10 may be connected to the computer network30, or may alternatively operate in a standalone mode without beingconnected to a network. The computer network is a type of computercommunication link or combination of computer communication linksspanning any geographical area, such as a local area network, wide areanetwork, regional network, national network, global network, or anycombination of these types of networks. These terms may refer tohardwire networks, wireless networks, dial-up networks, or a combinationof these or other networks. Hardwire networks may include, for example,fiber optic lines, cable lines, ISDN lines, copper lines, etc. Wirelessnetworks may include, for example, cellular systems, personalcommunication services (PCS) systems, satellite communication systems,packet radio systems, and mobile broadband systems.

[0070] Through the computer network 30, the computer system 10 is ableto exchange data with other computer systems that are additionallyconnected to the computer network 30, as shown by the computer system 20in FIG. 1. While FIG. 1 shows only two computer systems 10, 20 connectedto the computer network 30, additional computer systems may also beconnected to the computer network 30 to which communication links may beestablished for the exchange of data. The additional computer systems onthe network 30, such as the computer system 20 shown in FIG. 1, may beconfigured similar to the computer system 10 as illustrated in FIG. 1,or may be configured differently, for example, without some or all ofthe sector management system 150 components.

[0071] In some embodiments, one or more enterprise manager modules orcomponents may execute on any node on the network 30, such as thecomputer system 20. The manager capability may be utilized in anorganization with computers connected to a network, often referred to asan enterprise computing system. An Intranet, a network used to shareinformation within an organization accessible only by those within theorganization or others with authorization, is one example of anenterprise computing system. The enterprise manager modules include thecapability to initiate the storage or retrieval of sector statesremotely. For example, the enterprise manager modules executing on thecomputer system 20 are able to initiate the storage or retrieval ofstates of the computer system 10 via data communicated over the network30. Thus, using the example of FIG. 1, a computer system 10 that hasbecome non-operational may be remotely restored to an operational stateby someone, for example, Information Technology (IT) personnel, from thecomputer system 20. In other embodiments, the enterprise manager modulescontrol and initiate the storage or retrieval of sector states on amultitude of computer systems 10 that are connected to the network 30.

[0072] The enterprise manager may additionally include the capability tomonitor statistics regarding the storage or retrieval of sector stateson multiple remote computer systems that are connected to the network30. For example, such statistical data may include when recovery stateswere saved, when computer systems were restored to previously savedstates, or the number of storage or retrieval operations that have beenperformed on a computer by computer basis. Execution of the enterprisemanager is optional, however, as the sector management system is fullycapable of standalone operation, whether or not the computer system isconnected to a network.

[0073]FIG. 2 is a diagram illustrating the relationship between files,clusters and sectors in a file system 102 such as FAT16 or FAT32. Inthis example, each cluster is formed of 8 sectors. While the file inthis example may only require 19 sectors (represented by the verticaldash line) to store, it occupies 3 clusters because the cluster is thesmallest addressable file allocation unit in the file system 102. Thearrows from the end of one cluster to the next indicate that the file iscontinued in the next cluster. Another way to look at this is that instoring this file on the hard disk, only sectors 1-19 of the hard disk114 are written to or used, while sectors 20-24 are free. However, whilesectors 20-24 are free, the file system 102 is only able to addresssectors 17-24 together as cluster 3. The file system 102 indicates thatclusters 1-3 are already used to store a file, and thus cluster 3 isunavailable for the storage of another file. (The file system 102 asdescribed above cannot read the hard disk 114 at the sector level.) Thussectors 20-24 represent wasted space, usually called slack.

[0074] Referring again to FIG. 1, a hard disk controller 112 is thehardware interface to the hard disk 114. The hard disk controller 112manages the transfer of information to and from the hard disk 114. ATA(advanced technology attachment) also know as IDE (integrated driveelectronics), SCSI (small computer systems interface) and USB (universalserial bus) are examples of interfaces that can be employed as theinterface between the hard disk controller and the computer. One or morehard disk controllers 112 are often integrated into many motherboardchipsets, for example, those developed by Intel and AMD.

[0075] Because of the difference in addressable units between, forexample, the FAT16 and FAT32 file systems 102 (clusters) and the harddisk 114 (sectors), communications between the operating system 100 andthe hard disk 114 are often translated. In an example system, thistranslation is performed by the BIOS 110. In one example, the real modeI/O driver 108 uses interrupt 13 h (Int 13 h) to call the BIOS 110.Using the BIOS 110 to translate between the operating system 100 and thehard disk 114 incurs a performance cost. It also requires the use of thereal mode I/O driver 108, decreasing operating system stability. In DOSand earlier DOS-based versions of Windows, such as Windows 3.x andWindows 95, the real mode I/O driver 108 is used to communicate with thehard disk 114, thus necessitating the use of the BIOS 110 for theaforementioned translation.

[0076] Thus a more recent operating system 100, such as Windows NT and2000, may use a protected mode hard disk controller driver 116 tocommunicate with the hard disk 114, without the need to use the BIOS110. The protected mode hard disk controller driver 116 is usuallyspecific to the hard disk controller 112 in the computer, and is able toaddress the hard disk 114 at the sector level. ATA and SCSI hard diskcontrollers 112, for example, are also dedicated controllers optimizedto communicate with storage devices. In more recent Windows operatingsystems, e.g., Windows NT and 2000, the protected mode hard diskcontroller driver 116 loads towards the beginning of the boot process,and communication with the hard disk 114 is handled entirely by thisdriver.

[0077] In some other intermediate operating systems 100, such as laterDOS-based versions of Windows, including Windows 95OSR2, 98, 98SE andMe, a real mode I/O driver 108 is used to communicate with the hard disk114 while the operating system 100 is loading during the boot process ofthe computer. Thus the BIOS 110 may be used to translate communicationbetween the real mode I/O driver 108 and the hard disk 114. A protectedmode hard disk controller driver 116 is loaded with the operating system100. After the loading of the protected mode hard disk controller driver116, it takes over the communication with the hard disk 114, and thereal mode I/O driver 108 and the BIOS 110 are no longer used tocommunicate with the hard disk 114.

[0078] In certain embodiments, the sector management system BIOS filtermodule 118 intercepts read and write requests from the real mode I/Odriver 108 to the BIOS 110, for example, by intercepting interrupt 13 hcalls from the real mode I/O driver 108 to the BIOS 110. The BIOS filter118 may be implemented as a terminate-&-stay-resident (TSR) program.These embodiments may be used with DOS and earlier DOS-based versions ofWindows, such as Windows 3.x, Windows 95 and similar systems.

[0079] In other embodiments, the sector management system device drivermodule 120 intercepts read and write requests from the protected modehard disk controller driver 116 to the hard disk controller 112. Thisembodiment may be used with Windows NT and 2000 and similar systems.

[0080] In still further embodiments, the BIOS filter 118 intercepts readand write requests from the real mode I/O driver 108 to the BIOS 110,for example, while the operating system 100 is loading during the bootprocess of the computer. The device driver 120 intercepts read and writerequests from the protected mode hard disk controller driver 116 to thehard disk controller 112, for example, after the operating system 100has loaded. These embodiments may be used with later DOS-based versionsof Windows, such as Windows 95OSR2, 98, 98SE and Me and similar systems.

[0081] In some embodiments, intercepted write requests, whetherinterrupted by the device driver 120 or the BIOS filter 118, are passedto a Writes_Module 124. Similarly, intercepted read requests are passedto a Reads_Module 126. The Writes_Module 124 and the Reads_Module 126may redirect write and read requests to certain sectors, respectively,depending on the flags of the target sectors in matrix table(s) 122.Although illustrated in the embodiment of FIG. 1 as a matrix table 122,other embodiments utilize different ways of storing and retrievingsector data, for example, using an algorithm to generate pointerinformation, static or dynamic linking techniques, or the like. Forexample, sector data may be input to an algorithm that produces one ormore tables corresponding to one or more recovery points as appropriatefor the sector data. Redirecting of reads and writes to sectors ofmemory storage, for example, to perform read and recover operations, canthus be accomplished in multiple ways.

[0082] The sector management system 150 also includes an Identify_Module128 and a Recover_Module 130. The Writes_Module 124, the Reads_Module126, the Identify_Module 128 and the Recover_Module 130 all interactwith the matrix table(s) 122, as discussed in further detail below.

[0083] The functions described herein for the RS BIOS filter 118, the RSdevice driver 120, the Writes_Module 124, the Reads_Module 126, theIdentify_Module 128 and the Recover_Module 130, may also be implementedby other components in other embodiments of the sector management system150. For example, the sector management system 150 can be built into theBIOS 110, or implemented in the logic of the hard disk controller 112 orin the code of the protected mode hard disk controller driver 116.

[0084] Although described in reference to the embodiment illustrated inFIG. 1 and utilizing the Windows operating systems and their associateddevice drivers and hardware implementations, the systems and methodsdescribed herein may be implemented in numerous other embodimentsutilizing various other operating systems and hardware configurations.For example, in certain embodiments the systems and methods may beincorporated into the operating system, e.g., Windows. In suchembodiments, the system and method are integrated into and are part ofthe normal write and read flow of the operating system. In addition, thematrix table may be integrated into and be part of the FAT file systemdata. Still other embodiments are also possible, and are considered tobe within the scope of the present invention. For example, certainembodiments maintain the recovery data in other types of tables beside amatrix table, or organized in other ways besides in a table format.

[0085]FIG. 3 is a diagram illustrating a simplified representation of 12sectors, labeled A-L, of a hard disk. Though the sectors are shown inthis simplified representation as being physically contiguous, that isnot necessarily so in the hard disk. In addition, sectors A-L do not allneed to be located physically on one hard disk or memory device. Forexample, they can be located in multiple locations such as on RAID(redundant array of independent disks) devices or spread across avariety of memory devices. The first four sectors, A-D, are used, whichis represented by shading. The next eight sectors, E-L, are free. A“used” sector refers to a sector in which useful or valid data isstored. A “free” sector refers to a sector in which no useful data iscurrently stored. A free sector can be a sector that is actually blank,or a sector in which the data is no longer accessible. For example, whena file is deleted by the file system 102 such as FAT16 or FAT32, itscorresponding entry in the FAT may be simply deleted, without actuallyerasing the data from the sectors it occupies. While the data in thesectors may remain, the sectors appear to be free because the clustersthey belong to are not associated with an entry in the FAT.

[0086]FIG. 4 is a diagram illustrating the sectors of FIG. 3 after theIdentify_Module 128 has identified a set of recovery data. The set ofrecovery data reflects the state or contents of the memory at the pointin time at which the set of recovery data was identified. The point intime at which a set of recovery data or a recovery state is identifiedis alternatively referred to as a recovery point, sector state, memorystate, system state, computer state, or personal computer (PC) state.Accordingly, these terms are generally synonymous as used herein and maybe substituted for one another while maintaining consistent meaning andexplanation. Thus recovery point 1 refers to the point in time at whichrecovery data set 1 was identified. The set of recovery data isidentified so that the sector management system 150 can recover (orrestore) the memory to that state at a later time. In FIG. 4 the firstset of recovery data is located in the sectors A-D which are to the leftof the vertical line between sectors D and E. In this example, the setof recovery data includes data in sectors that are already in use whenthe set of recovery data is identified. In this example sectors A-D arethe sectors in use that contain the first set of recovery data, e.g.,recovery data set 1. For ease of discussion, sectors A-D are representedas being contiguous, or adjacent to each other, and thus the identifiedrecovery data, recovery data set 1, can be delineated by a vertical linewhich separates the sectors containing the recovery data, sectors A-D,from the other sectors E-L. Of course, the sectors containing the set ofrecovery data do not have to be contiguous or adjacent. The sectormanagement system 150 may allow the user to create a recovery point. Thesector management system 150 may also be configured to automaticallycreate a recovery point periodically, for example, for a weekly backup.The sector management system 150 may also be triggered by certain eventsto create a recovery point, for example, after a scandisk operationfinds a bad cluster.

[0087]FIG. 5 is a diagram illustrating a representation of a matrixtable, e.g., matrix table 1, associated with the recovery data set 1discussed above with regard to FIG. 4. In some embodiments, theIdentify_Module 128 creates a matrix table for each set of recoverydata. After the Identify_Module 128 creates the matrix table 122, itsaves a copy of the matrix table as an original version. Subsequentchanges to the matrix table are saved in a working version. The sectormanagement system 150 uses one or more matrix tables to track the statusor state of sectors. The matrix table(s) can be located in protectedsections on the hard disk or memory. Alternatively they can be stored inother locations, for example, a dedicated area on the hard disk, and onother memory devices, for example, a flash memory USB dongle (a devicethat attaches to a computer to control access to a particularapplication is often referred to as a dongle). In this embodiment, thematrix table tracks six types of sector status defined as follows:

[0088] 1. Already_Used (AU)—Sectors already used before the sectormanagement system 150 identifies recovery data at a recovery point.

[0089] 2. RS_Free (RSF)—Sectors that are actually free, as determined bythe sector management system 150.

[0090] 3. RS_Used (RSU)—Sectors used by the sector management system 150to store new data that would otherwise overwrite data in protectedsectors.

[0091] 4. Newly_Used (NU)—Sectors used to store new data that would notoverwrite data in protected sectors.

[0092] 5. Current_Redirected (CR)—Sectors redirected to other sectors.

[0093] 6. Previous_Redirected (PR)—Similar to Current_Redirected, butused when there is more than one recovery point. The creation of morerecovery points is discussed in further detail below.

[0094] The sectors of the hard disk 114 or other memory are identifiedas being one of the six status types in the matrix table 122. In someembodiments, the matrix table 122 needs only to explicitly track five ofthe six status types of sectors, while the sixth status type is derivedfrom the other five via a process of elimination. In still furtherembodiments, fewer or greater numbers of status types may be used, andthese embodiments are also within the scope of the present invention.However, the discussion is more easily followed if the embodimentutilizing six status types is discussed.

[0095] In certain embodiments, a new matrix table is created for everyset of recovery data or recovery point. A copy of each newly createdmatrix table is saved as the original version to represent the state ofthe hard disk 114 at that recovery point. The original version of thematrix table 122 is used to recover to the corresponding recovery point,as discussed in further detail below. As write requests are redirectedand sector status type flags are changed after the identification ofrecovery data, these changes are saved to the working version of thematrix table 122. While the two versions of the matrix table 122 may beconceptualized as separate tables, the working version may berepresented as a list of changes to the original version. Theinformation stored in the matrix tables 122 does not necessarily have tobe stored in a matrix table for each recovery point. In otherembodiments, for example, all the redirections and changes to sectorstatus type flags from multiple recovery points can be stored together,as long as the information associated with each recovery point can bedelineated from the information associated with other recovery points.

[0096] As write requests are intercepted and redirected to othersectors, the sectors that appear to the file system as free (thosebelonging to free clusters) may have actually been used by the sectormanagement system 150, e.g., to store redirected write requests. Thusthe sector management system 150 tracks via the matrix table sectorsthat are actually free with the status type flag RS_Free. In otherembodiments in which the present systems and methods are integrated intothe operating system, the write requests are more aptly described asbeing part of the normal write flow of the operating system rather thanbeing intercepted as described above.

[0097] Referring again to FIG. 1, the file system 102 generates a writerequest directed at one or more clusters. The write request istranslated and expressed in sectors by either the BIOS 110 or theprotected mode hard disk controller driver 120. The translated writerequests are intercepted (or trapped) in certain embodiments by the RSBIOS filter 118 or, alternatively, by the RS device driver 120, beforethey reach the hard disk 114. The Writes_Module 124 of the sectormanagement system 150 processes the intercepted write requests.

[0098] In connection with the embodiments of FIGS. 6-10 as describedbelow, the processing of write requests by the sector management system150 are discussed in detail. The left columns in those figures areflowcharts representing the process or steps. The middle columns showchanges to the matrix table associated with the steps. The right columnsillustrate graphical representations of the 12 example hard disk sectorsshown in FIG. 3.

[0099]FIG. 6 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom the file system 102 to a sector flagged as Already_Used. In step600 the RS BIOS filter 118 or the RS device driver 120 intercepts awrite request to sector A. As was noted above with regard to FIG. 1, thewrite request can be intercepted, for example, via BIOS Int 13 h (RSBIOS filter 118) or by intercepting the write request from the protectedmode hard disk controller driver 116 (RS device driver 120). In otherembodiments in which the present systems and methods are integrated intothe operating system, the write requests are more aptly described asbeing part of the normal write flow of the operating system rather thanbeing intercepted as described above. In step 602 sector A is determinedto be flagged as Already_Used by reference to matrix table 1. At thispoint the original version and the working version of matrix table 1 arethe same, as there has not been any changes yet. In step 604 theWrites_Module 124 finds a sector that is flagged as RS_Free from theworking version of matrix table 1, e.g., sector E. Sector E is thenflagged as RS_Used in the working version of matrix table 1 in step 606.In step 608 the data contained in the write request of step 600 iswritten to sector E. In step 610 sector A is flagged asCurrent_Redirected in the working version of matrix table 1. In step 612the redirection from sector A to sector E is updated in the workingversion of matrix table 1 to represent that the current data of sector Ais in sector E. While the last four steps, steps 606-612, areillustrated in a particular order, they may actually be carried out inany order. The foregoing steps or process protect the data in sector Afrom being overwritten while allowing the computer system to operate asif sector A had been overwritten. This can enable the sector managementsystem 150 to be transparent to the file system 102.

[0100]FIG. 7 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom the file system 102 to a sector flagged as RS_Free. In step 700, inthe same manner as described above in connection with step 600, a writerequest to sector F is intercepted. In step 702 the Writes_Module 124refers to the working version of matrix table 1 and determines thatsector F is flagged as RS_Free. In step 704 sector F is flagged asNewly_Used in the working version of matrix table 1. In step 706 thedata contained in the write request of step 700 is written to sector F.The last two steps, steps 704 and 706, may be carried out in reverseorder. Write requests to RS_Free sectors do not have to be redirectedbecause no protected data, that is, data contained in sectors identifiedas recovery data set 1, are being overwritten.

[0101]FIG. 8 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom file system 102 to a sector flagged as RS_Used. In step 800 a writerequest to sector E is intercepted in the manner described above. Notethat as discussed above, while the file system 102 may see sector E as afree sector, it is actually in use to store redirected data that wouldhave otherwise overwritten sector A. In step 802 the Writes_Module 124refers to the working version of matrix table 1 and determines thatsector E is flagged as RS_Used. In step 804 the Writes_Module 124 findsa sector that is flagged as RS_Free from the working version of matrixtable 1, e.g., sector G. Sector G is then flagged as RS_Used in theworking version of matrix table 1 in step 806. In step 808 the datacontained in the write request of step 800 is written to sector G. Instep 810 sector E is flagged as Current_Redirected in the workingversion of matrix table 1. In step 812 the redirection from sector E tosector G is updated in the working version of matrix table 1. While thelast four steps, steps 806-812, are illustrated in a particular order,they may actually be carried out in any order. As discussed above,RS_Used sectors are used by the sector management system 150 to storedata that would have otherwise overwritten protected sectors, or sectorsidentified as containing data belonging to a recovery data set. Thuswrite requests to RS_Used sectors are redirected, to preserve the datatherein. Subsequent write requests to sector E are also redirected tosector G. Sector G appears transparently to the file system as sector E.

[0102]FIG. 9 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom the file system 102 to a sector flagged as Newly_Used. In step 900a write request to sector F is intercepted in the manner describedabove. In step 902 the Writes_Module 124 refers to the working versionof matrix table 1 and determines that sector F is flagged as Newly_Used.In step 904 the data contained in the write request of step 900 iswritten to sector F. Because sector F did not contain data to beprotected, as sector F was not in use before recovery data set 1 wasidentified at recovery point 1, the sector management system 150 allowssector F to be overwritten.

[0103]FIG. 10 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom file system 102 to a sector flagged as Current_Redirected. In step1000 a write request to sector A is intercepted in the manner describedabove. In step 1002 the Writes_Module 124 refers to the working versionof matrix table 1 and determines that sector A is flagged asCurrent_Redirected. In step 1004 the Writes_Module 124 determines fromthe working version of matrix table 1 the sector to which sector A isredirected, sector E. In step 1006 the data contained in the writerequest of step 1000 is written to sector E. Although sector E is itselfredirected to sector G, a write request to sector A is redirected tosector E. A write request directly to sector E will be redirected tosector G. Sector E appears transparently to the file system 102 assector A. Sector G also appears transparently to the file system assector E, as discussed above.

[0104] Thus the data contained in sectors A-D are not overwritten afterthey are identified as containing data belonging to recovery data set 1at recovery point 1. However, the computer system can operate as if theyhad been overwritten while preserving them for recovery purposes,because the redirections can be transparent to the file system.

[0105] The sector management system 150 also process read requests. Readrequests are intercepted in the same manner as write requests by the RSBIOS filter 118 and the RS device driver 120 as discussed above. In someembodiments, the read requests from the file system 102 intercepted bythe RS BIOS filter 118 or the RS device driver 120 can be processed by aReads_Module 126. In other embodiments in which the present systems andmethods are integrated into the operating system, the read requests, aswell as the write requests, are more aptly described as being part ofthe normal read flow of the operating system rather than beingintercepted as described above. The Reads_Module 126 redirects readrequests to some sectors depending on their status flags in the matrixtable associated with the current recovery point. Basically, all sectorsare read directly, except those sectors flagged as Current_Redirected orPrevious_Redirected. Read requests to these sectors are redirectedaccording to its entry in the current matrix table. Previous_Redirectedsectors will be discussed in further detail below with regard tosubsequently identified recovery data sets at later recovery points.

[0106]FIG. 11 is a diagram illustrating a representation of theaforementioned 12 sectors that indicates a new recovery data set, e.g.,recovery data set 2, identified at a new recovery point, e.g., recoverypoint 2. As discussed above, in some embodiments of the invention, theIdentify_Module 128 identifies a new set of recovery data, recovery dataset 2, at recovery point 2, and creates the corresponding matrix table2. The processes now described follow the example discussed in FIGS.6-10. The recovery data identified as recovery data set 2 at recoverypoint 2 is stored in the sectors to the left of the vertical linebetween sectors G and H. At recovery point 2, sectors A-G are in use,while sectors H-L are free.

[0107]FIG. 12 is a diagram illustrating an embodiment of a second matrixtable, e.g., matrix table 2, corresponding to recovery data set 2 ofFIG. 11. The Identify_Module 128 creates the original version of matrixtable 2 from the working version of matrix table 1 with the followingalgorithm: Flag in previous matrix table: Flag in new matrix table: 1.Already_Used Already_Used (unchanged) 2. RS_Free RS_Free (unchanged) 3.RS_Used RS_Used (unchanged) 4. Newly_Used Already_Used 5.Current_Redirected Previous_Redirected 6. Previous_RedirectedPrevious_Redirected (unchanged)

[0108] Sectors that are flagged as Already_Used, RS_Free, RS_Used andPrevious_Redirected in the working version of matrix table 1 remainunchanged in the original version of matrix table 2. Sectors flagged asNewly_Used in the working version of matrix table 1 are flagged asAlready_Used in the original version of matrix table 2. For example,sector F is flagged as Already_Used in the original version of matrixtable 2 because, at recovery point 2, sector F contains useful datawritten after the identification of recovery data set 1 and must also beprotected. Sectors flagged as Current_Redirected in the working versionof matrix table 1 are flagged as Previous_Redirected in the originalversion of matrix table 2. For example, sector A and its target sector E(represented as A=>E) are flagged as Previous_Redirected in the originalversion of matrix table 2, because a write request to sector A after theidentification of recovery data set 2 should not be redirected to sectorE, as sector E saves the data in sector A before the identification ofrecovery data set 2. This is discussed in more detail below. These stepsensure that the original version of matrix table 2 reflects theconditions of the hard disk sectors at recovery point 2.

[0109] Write requests to sectors marked as Already_Used, RS_Free,RS_Used, Newly_Used, and Current_Redirected have already been discussedwith respect to matrix table 1 in FIGS. 6-10. Write requests from thefile system 102 to these types of sectors after the identification ofrecovery data set 2 are handled in the same manner as was described withrespect to FIGS. 6-10 using the working version of matrix table 2. Oncea new matrix table is created, e.g., matrix table 2, reference isusually only made to an earlier matrix table, e.g. matrix table 1, whenrestoring the hard disk to the state reflected by the recovery data setassociated with that earlier table. Therefore, the working version ofmatrix table 1 can be discarded and only the original version of matrixtable 1 needs to be retained, for example, for recovery or restorepurposes.

[0110]FIG. 13 is a diagram illustrating an embodiment of a process,matrix tables and sector representations associated with a write requestfrom file system 102 to a sector flagged as Previous_Redirected, withrespect to matrix table 2 shown in FIG. 12. At this point, the contentsof both the original and the working versions of matrix table 2 areidentical. In step 1300 a write request from the file system 102 tosector A is intercepted in the manner described above. In step 1302 theWrites_Module 124 determines from the working version of matrix table 2that sector A is flagged as Previous_Redirected. In step 1304 theWrites_Module 124 finds a sector from the working version of matrixtable 2 that is flagged as RS_Free, e.g., sector H. Sector H is thenflagged as RS_Used in the working version of matrix table 2 in step1306. In step 1308 the data contained in the write request of step 1300is written to sector H. In step 1310 sector A is flagged asCurrent_Redirected in the working version of matrix table 2. In step1312 the redirection from sector A to sector H is updated in the workingversion of matrix table 2. While the last four steps, steps 1306-1312,are illustrated in a particular order, they may actually be carried outin any order. Further read and write requests to sector A are alsoredirected to sector H.

[0111]FIG. 14 is a diagram illustrating a representation of the 12 harddisk sectors with two identified recovery data sets. Recovery data set 1includes the sectors to the left of line 1, and recovery data set 2includes the sectors to the left of line 2. As sector H is now flaggedas RS_Used, a write request from the file system 102 to sector H ishandled just like the write request to sector E as described withrespect to FIG. 8. A write request from the file system 102 to sector His redirected by the Writes_Module 124 to sector I, as sector H isflagged as RS_Used in the working version of matrix table 2. This isrepresented by the arrow from sector H to sector I in FIG. 14.

[0112]FIG. 15 is a diagram illustrating an embodiment of thecorresponding changes to the working version of matrix table 2 made bythe Writes_Module 124 after redirecting to sector I a write request fromthe file system to sector H as discussed above with regard to FIG. 14. His flagged as Current_Redirected and sector I is flagged as RS_Used inthe working version of matrix table 2.

[0113]FIG. 16 is a diagram illustrating a representation of a newrecovery data set, e.g., recovery data set 3, identified by theIdentify_Module 128 at recovery point 3. Recovery data set 3 isdelineated by the vertical line, line 3, between sectors I and J. FIG.17 is a diagram illustrating an embodiment of a new matrix table, e.g.,matrix table 3, created by the Identify_Module 128. Matrix table 3 iscreated using the process described above with respect to FIG. 12.Again, a copy of the matrix table 3 is saved as an original version, andthe Writes_Module 124 and the Reads_Module 125 make changes to theworking version of matrix table 3.

[0114]FIG. 16 represents the 12 hard disk sectors, A-L, after theIdentify_Module has identified recovery data set 3 at recovery point 3.The corresponding new matrix table, matrix table 3, is illustrated inFIG. 17. The process of identifying a recovery data set and creating acorresponding new matrix table is discussed above with regard to FIG.12. Once again, only sectors that are flagged as either Newly_Used orCurrent_Redirected are reflagged in the new matrix table, matrix table3. There are no Newly_Used sectors in the working version of matrixtable 2. The two Current_Redirected sectors in matrix table 2, A and H,are reflagged as Previous_Redirected in matrix table 3. Again, afterthese changes are made, an original copy of matrix table 3 is saved andthe working version is used by the Writes Module 124.

[0115]FIG. 18 is a diagram illustrating a further representation of the12 hard disk sectors with three identified recovery data sets. A writerequest from the file system 102 to sector J is represented by thehollow arrow on top of sector J. Write requests from the file system 102to RS_Free sectors have already been discussed above with regard to FIG.7. At this point, the contents of both the original and the workingversions of matrix table 3 are identical. The Writes_Module 124determines that sector J is flagged as RS_Free in matrix table 3 (asshown in FIG. 17), writes the data to sector J, and changes its flag toNewly_Used in the working version of matrix table 3 (as shown in FIG.19).

[0116]FIG. 19 is a diagram illustrating an embodiment of arepresentation of the working version of matrix table 3 after theWrites_Module 124 processes the write request to sector J. As discussedabove with regard to FIG. 18, the Writes_Module 124 has changed the flagof sector J from RS Free to Newly_Used in the working version of matrixtable 3.

[0117] Restoring the hard disk to a state reflected by the data in apreviously identified recovery data set will now be discussed. Incertain embodiments, referring back to FIG. 1, the recovery algorithmcan be implemented in and performed by a Recover_Module 130. Three setsof recovery data, recovery data sets 1-3, have been identified atrecovery points 1-3, respectively, in the embodiments described thusfar. In other embodiments, the Recover_Module 130 restores the hard diskto a state reflected by a previously identified recovery data set byidentifying a new recovery data set and creating a corresponding newmatrix table.

[0118]FIG. 20 is a diagram illustrating an embodiment of an overview ofthe newly identified recovery data set, e.g., recovery data set 4.Recovery data set 4 is identified at recovery point 4. At recovery point4, sectors A-J are in use. These sectors are delineated by the verticalline marked 4(1). The (1) denotes that the sector management system 150is restoring the hard disk to the state reflected by recovery data set1.

[0119]FIG. 21 is a flowchart illustrating an embodiment of a processperformed by the Recover_Module 130 to restore the hard disk to a statereflected by a previously identified recovery data set. In step 2100 theRecover_Module 130 identifies a new recovery data set n to restore thehard disk to the state reflected by a previously identified recoverydata set a. In step 2102, the Recover_Module 130 creates the originalversion of the corresponding matrix table n by copying the originalversion of matrix table a. As discussed above, the original versionrefers to the contents of the matrix table, which reflects the state ofthe hard disk sectors at the identification of its correspondingrecovery data set. In step 2104, the Recover_Module 130 compares theRS_Free sectors in matrix table n to the RS_Free sectors in the workingversion of matrix table n-1, the matrix table reflecting thethen-current state of the hard disk. In step 2106, each RS_Free sectorin matrix table n that is not also flagged as RS_Free in working versionof matrix table n-1 is reflagged as Already_Used in matrix table n bythe Recover_Module 130, because that means that such sector is actuallyin use.

[0120]FIG. 22 is a diagram illustrating in greater detail an embodimentof a process, matrix tables and sector representations associated withthe embodiment shown in FIG. 20, with the Recover_Module 130 performingthe process as discussed above with regard to FIG. 21. As in FIG. 20,the Recover_Module 130 identifies recovery data set 4 to restore thehard disk to the state reflected by recovery data set 1 in step 2200.Recovery data set 4 is delineated by the vertical line between sectors Jand K, designated 4(1). In step 2202, the Recover_Module 130 creates theoriginal version of matrix table 4 by copying the original version ofmatrix table 1. In the graphical representation of the 12 sectors in therightmost column, sectors E-J lose the gray shading which indicates asector in use, as they are flagged as RS_Free in the working version ofmatrix table 4. In step 2204, the Recover_Module 130 compares theRS_Free sectors in the working version of matrix table 4 to the RS_Freesectors in the working version of matrix table 3. (The working versionof matrix table 3 is derived from FIG. 19.) In step 2206, each RS_Freesector in the working version of matrix table 4 that is not also flaggedas RS_Free in matrix table 3 is reflagged as Already_Used in the workingversion of matrix table 4 by the Recover_Module 130. These are sectorsE-J. Sectors E-J have already been used before the identification ofrecovery data set 4, and are not actually free. Once again, after theRecover_Module 130 creates the original version of matrix table 4 andperforms the comparison against the working version of the previousmatrix table (as well as any necessary changes), it saves the originalversion of matrix table 4, which reflects the state of the hard disk atthe point in time at which recovery data set 4 is identified. If thereare any further changes to the hard disk, the resulting changes areupdated in the working version of matrix table 4.

[0121] Creating a new recovery point to recover to a previous recoverypoint uses more sectors than just going backwards to the target recoverypoint, canceling the redirection of redirected sectors, and deleting thenow unnecessary sectors. However, creating a new recovery point torecover to a previous recovery point allows the redirections created inall the recovery points to be saved. This enables the sector managementsystem 150 to restore to a later recovery point without any loss ininformation, e.g., restoring to recovery point 3 after recovering torecovery point 1. Restoring and recovering refer to going from anearlier recovery point to a later recovery point, as well as going froma later recovery point to an earlier recovery point. Therefore, whilethe systems and methods described herein generally refer to restoring asbeing from an earlier recovery point to a later recovery point, andrecovering as being from a later recovery point to an earlier recoverypoint, this is for illustrative purposes only. Both restoring andrecovering refer to altering the state or configuration of a computersystem to a saved state or configuration, and thus do not necessarilyhave any chronological limitations.

[0122]FIG. 23 is a diagram illustrating an embodiment of a process,matrix tables and sector representations in which the Recover_Module 130creates recovery point 5 to restore to recovery point 3 after creatingrecovery point 4 to recover to recovery point 1 as shown in FIG. 22.Conceptually, there is only a semantic difference between restoring andrecovering, as recovery point 5 can be thought of as being created torecover to recovery point 3. In step 2300, the Recover_Module 130creates recovery point 5 to recover to recovery point 3. This isrepresented by the vertical line between sectors J and K, designatedrecovery point 5(3). As the sector management system 150 has made nochanges to matrix table 4 before the creation of matrix table 5,recovery point 5 and recovery point 4 lies on the same line. In step2302, the Recover_Module 130 creates matrix table 5 by copying theoriginal version of matrix table 3. The original version of matrix table3 is illustrated in FIG. 17. In the graphical representation of the 12sectors in the right column, sector J loses the gray shading whichindicates a sector in use, as it is flagged as RS_Free in matrix table5. In step 2304, the Recover Module 130 compares the RS Free sectors inmatrix table 5 to the RS_Free sectors in the working version of matrixtable 4. In step 2306, each RS_Free sector in matrix table 5 that is notalso flagged as RS_Free in matrix table 4, e.g. sector J, is reflaggedas Already_Used in matrix table 5 by the Recover_Module. This is sectorJ. Sector J has already been used in other recovery points, and is notactually free. Note that the arrows representing sector redirectionscreated in recovery points 1-3 are present in the graphicalrepresentation of the 12 sectors, corresponding the Previous_Redirectedsectors in matrix tables 3 and 5. This. reflects the state of the harddisk at the creation of recovery point 3.

[0123] In the foregoing discussion, an original version and a workingversion of the matrix table 122, both corresponding to the same recoverypoint, have been discussed. In certain embodiments, the original versionis saved to the hard disk 114 while the working version is stored in theRAM. After the creation of a new matrix table corresponding to a newrecovery point, the working version of the previous matrix tablecorresponding to the previous recovery point may be erased oroverwritten to save space. For example, as discussed above with regardto FIG. 22, when the Recover_Module 130 creates matrix table 4 whencreating recovery point 4 to recover to recovery point 1, part of theprocess involves comparing RS_Free sectors with the working version ofmatrix table 3. After the comparison is performed and the newly createdmatrix table 4 is saved as an original version, the working version ofmatrix table 3 is no longer needed. Thus the sector management system150 can overwrite the working version of matrix table 3 with the workingversion of matrix table 4. The working version of matrix table 3 is usedto track changes after the creation of recovery point 4.

[0124] In further embodiments, the above described systems and methodsare employed on a remote server computer that is accessible via anetwork. In these embodiments, the system is configured similarly tothat shown in FIG. 1 where the computer system 10 is a server computer.In certain embodiments, the server computer includes a higher level ofsoftware that performs additional functionality typically allocated toserver computers, e.g., servicing memory access, controlling memoryrequests and resolving memory conflicts. In systems having, for example,specialized memory devices such as Advanced Technology Attachment (ATA)devices or Redundant Array of Independent Disks (RAID), the system takesinto account additional considerations, e.g., data striping or diskmirroring.

[0125] In addition to creating recovery states, as illustrated anddescribed in relation to at least FIGS. 11, 16, 20 and 23, the sectormanagement system 150 is additionally configured to delete or remove oneor more saved recovery points. In the case where the recovery point tobe removed is the most recently saved recovery point, e.g., the lastrecovery point, the recovery point can be removed by deleting theassociated matrix table. For example, referring to FIG. 16, recoverypoint 3 (the most recently saved recovery point in FIG. 16) could beremoved by deleting the matrix table for recovery point 3, which isshown in FIG. 17. In this example, after the removal of recovery point3, two recovery points would remain, namely recovery point 1 andrecovery point 2. Upon removal of a saved recovery point, the memorylocations used by the matrix table can be released or freed up and madeavailable for other use by the computer system. In addition, memorylocations that are no longer needed due to the removal of the recoverypoint can also be released for other use. This is discussed in greaterdetail below.

[0126] For the cases where the recovery point to be removed is not themost recently saved recovery point, e.g., removing an intermediaterecovery point for which there is at least one prior recovery point andat least one subsequent recovery point, one or more additional steps maybe performed. For example, in addition to removing the matrix tableassociated with the recovery point as described above, the matrix tableassociated with the recovery point to be removed may be compared to thematrix table associated with the first recovery point and the matrixtable associated with the last recovery point. If the matrix tablesassociated with the first and last recovery points do not contain anentry, e.g., a memory location such as a disk sector, that is in theintermediate recovery point, the intermediate recovery point can beremoved by deleting the associated matrix table as well as the datastored in the memory location.

[0127] To illustrate by way of specific example, suppose that recoverypoints 1, 2 and 3 have been saved and recovery point 2 is to be removed.In this example, the matrix tables associated with recovery points 1, 2and 3 are as follows:

[0128] Recovery point 1 Already_Used: A B C

[0129] Recovery point 2 Already_Used: C Current_Redirected: A B RS_Used:E F

[0130] Recovery point 3 Already_Used: B Current_Redirected: A C RS_Used:E G

[0131] If any memory locations that are used in the recovery point beingremoved are not used in the other recovery points, these memorylocations can be released. In the present example, before removing thematrix table associated with recovery point 2, it is compared with thematrix tables associated with recovery points 1 and 3. Here, sector A isused in recovery point 2, as indicated by its Current_Redirected statusin the matrix table. Since sector A is also used in recovery points 1and 3, as indicated by its Already_Used and Current_Redirected status,respectively, sector A is not released. Similarly, sectors B and C arenot released.

[0132] Sector F is also used in recovery point 2, as indicated by itsRS_Used status. However, sector F is not present in the matrix table forrecovery points 1 and 3. Therefore, sector F is not needed after theremoval of recovery point 2, and the memory space used by sector F canbe released and made available for other use by the computer system (asdescribed below). However, since sectors E and G are marked as RS_Usedin the matrix table for recovery point 3, they are not released whenrecovery point 2 is removed.

[0133] As noted in the above examples, when memory locations are nolonger needed due to the removal of a recovery point, the memory may bereleased and made available for other use by the computer system. Memorycan be released, for example, by altering the FAT table to indicate thatthe memory is no longer used by the system. As a further example, memorylocations may be released by invoking an interface of the operatingsystem, such as an application program interface (API), that performsoperating system instructions that cause the memory to be identified asavailable for use by the system. In addition to releasing memorylocations that are no longer used by the sector management system 150,removing a recovery point is also beneficial in that the memory used tostore the matrix table itself may be released, such that this releasedmemory is then available for other use by the computer system.

[0134] While the above description of the sector management system hasincluded various embodiments in which the storage and retrieval ofrecovery points or sector states has been initiated by the pressing ofcertain function keys on a computer keyboard, other embodiments utilizedifferent mechanisms. For example, the sector management system mayinitiate the storage or retrieval of sector states at a specific time ofday or on a specific date, for example, by utilizing the timerfunctionality available on many computer systems. Several examples oftimer events that may be utilized include the time counting down to azero value, or counting up to a pre-determined value.

[0135] In addition, the storage or retrieval of sector states may beinitiated upon the satisfying of one or more pre-determined conditionsor upon the occurrence of one or more events. A pre-determined conditionis a condition or event that is identified and selected prior to theoccurrence of the condition or event. For example, the sector managementsystem may be configured to automatically store a recovery point when anew software application is loaded onto the computer system or when anew revision of the operating system or software application isinstalled onto the computer system. As an additional example, the systemmay be configured to automatically retrieve a recovery state upon theoccurrence of a certain system error or the detection of corrupted datathat may cause operating system or application program errors.

[0136] Additional embodiments utilize the recovery points asconfigurations of the computer system using the systems and methodspreviously described. Thus, the sector management systems can beutilized to implement configuration management features to switchbetween various versions of the operating system, operating environment,application programs, test version configurations, or releasable levelsof the computer system.

[0137] Configuration management features include version controlcapabilities to switch between certain configuration states (stored asrecovery points) depending on the version of the operating system orapplication program that is desired for a computer system or user. Thistypically occurs when the system is booted or the user logs on. In otherwords, various configuration states may be stored as recovery pointsthat correspond to particular operating system, operating environment,or application program versions. For example, a recovery point 1 canrepresent the Windows 98 version of the operating system, a recoverypoint 2 can represent the Windows ME version of the operating system,and a recovery point 3 can represent the Windows NT version of theoperating system. Similarly, recovery points can correspond to varioustest configurations or test versions for users that utilize features ofthe sector management system 150 to control or manage various versionsof the operating environment while performing test procedures.

[0138] In the embodiments in which the enterprise manager functionalityis utilized on a remote computer system, the various operating system orapplication program versions may exist on the remote computer system,and be updated or downloaded to the computer system being logged on tovia the network. The sector management system also allows the comparisonof the version of a file corresponding to a certain recovery state withanother version of the file corresponding to a different recovery state.

[0139] The sector management system is further capable of storing andretrieving recovery states that correspond to releasable levels of theoperating system or application programs. For example, a user can storea first computer state, load a new version of a particular applicationprogram, store a second computer state, load an update to the operatingsystem, store a third computer state, load a new version of anotherapplication program, and store a fourth computer state. If it isdiscovered that the new or updated versions of the application programsor operating system causes, for example, errors, unpredictablebehaviors, or crashes of the computer system, the user can back out theupdate(s) by restoring to a previous, known working version of thecomputer system.

[0140] The sector management system additionally includes securityfeatures, for example, that cause the computer system to be inoperablewhen accessed by an unauthorized user. For example, different recoverypoints or sector states may have different protection criteria forrestricting access to protected partitions or sectors. Thus, somerecovery states may allow access to certain partitions by a particularuser, while other recovery states may not allow access to the samepartition by a different user. In addition, recovery states may includepassword information, so that passwords that have been changed, forexample, without proper authorization, may be restored to the previousvalid password by recovery to a state prior to the unauthorized change.

[0141] Other security features of the sector management system includethe capability to configure the computer system to crash upon access byan unauthorized user, such as in the case of the physical theft of thecomputer system. For example, the sector management system may beconfigured to have a recovery state that causes the computer system tobe inoperable, and to retrieve the inoperable recovery state uponunauthorized access so that the computer system becomes inoperable. Inthis case, the computer system can be recovered by restoring to apre-crash state, after entry of an authorized password. The securityfeatures described above are optional and configurable, however, as thesector management system also can execute in a non-secure mode, orvarious levels of security in which certain security features may beselectively turned on or off. For example, in a non-secure mode ofoperation, any user can remove existing recovery points, any user canstore new recovery points, and any user can retrieve any recoverypoints. In other example, only certain users are authorized to add,remove and retrieve certain recovery point. As an illustration, one usermay not be able to retrieve recovery points stored by any other user orby other users in a different group.

[0142] The sector management system can additionally include variousmulti-user or multi-project system features. Examples of multi-userfeatures include the capability to switch to certain recovery statesdepending on the particular user that has logged on. In this way, thestate of the computer system can be different for different users orclasses of users, and is transparent to the user. For example, recoverypoints can be stored that correspond to a specific user, such that whenthe user logs in to the computer system, the recovery pointcorresponding to the user's specific computer system configuration canbe retrieved. In addition, groups of users can be assigned certainattributes, for example, users that work in a particular department oron a particular project, such that recovery points can be automaticallyretrieved when any one of the users in the group logs in. In addition,the sector management system can switch to project-specific recoverystates, according to the project that the particular user is assignedto, or if logins are specific to a particular project (such as usersworking on Project Alpha who access the computer system using a specificProject Alpha login, and a recovery state is restored that configuresthe system for use by Project Alpha users). Thus, computer systems canbe configured with multiple profiles to provide project partitioning andsupport for a number of various project configurations. Still further,computer systems can be configured as shared systems that provide aseparate state for each of a multitude of operators to enable a shiftoperation capability, for example, three shift operators can share asingle computer system.

[0143] The sector management system additionally provides the capabilityto view and/or recapture data and/or files as they existed in a recoverypoint. For example, a user of the computer system may save two recoverypoints, for example, recovery point 1 and recovery point 2. Afterrestoring the computer system to recovery point 1, the user can copyvarious data files as they existed in recovery point 2. The savedrecovery point 2 can be accessed by creating or mounting a virtualdrive, for example, by invoking an interface to the operating systemsuch as an application program interface (API). For example, the Windows2000 operating system includes such an API. That API creates a read onlyvirtual drive based upon provided memory locations. Therefore, thesector management system provides the list of memory locations whichcorresponds to recovery point 2 to the API. The API then generates thevirtual drive. Files located on the virtual drive can be read andcopied. Alternatively, the sector management system can include a moduleto perform this function.

[0144] The data files can then be copied from the virtual drive to theactive operating environment. By creating a virtual drive, certain datastored on the memory or hard disk can appear to the operating system asa separate device, although it is in fact physically located on thememory or hard disk. A virtual drive is typically a read only device, inthat data can be read from a virtual drive but data may not be writtenor copied to the virtual drive. Once the desired data files are copiedinto the current operating environment, the virtual drive may be deletedor dismounted, after which the drive is no longer visible to theoperating system and the data contained therein is not readilyaccessible.

[0145] The sector management system also allows for faster scanning andrecovery after a computer virus, worm, or other program or piece ofcomputer code that is loaded onto a computer system without the user'sknowledge and runs against the user's wishes, usually in a destructiveor malicious manner. After such a virus or worm is detected, the user ora system operator typically executes a virus scanning program to checkall or a substantial number of the files on the computer system for thepresence or infection of the virus or worm. However, where computerstates have been saved using the sector management system as describedabove, the virus scanning program would only need to check the sectorsthat have been modified after the virus was detected. The files orsectors modified prior to the infestation of the virus or worm would notbe affected and thus would not need to be scanned. This feature couldpotentially speed up, sometimes by a significant amount, the timerequired to scan the computer system for presence of a virus or worm.

[0146] While the above detailed description has shown, described, andpointed out novel features of the invention as applied to variousembodiments, it will be understood that various omissions,substitutions, and changes in the form and details of the device orprocess illustrated may be made by those of ordinary skill in thetechnology without departing from the spirit of the invention. Thisinvention may be embodied in other specific forms without departing fromthe essential characteristics as described herein. The embodimentsdescribed above are to be considered in all respects as illustrativeonly and not restrictive in any manner. The scope of the invention isindicated by the following claims rather than by the foregoingdescription.

What is claimed is:
 1. A method of recovery to a saved memory state in acomputer system having a memory, the method comprising: receiving awrite request to a first memory location; determining whether said firstmemory location contains protected data; redirecting said write requestto a second memory location if said first memory location containsprotected data, thereby preserving the contents of the first memorylocation for a first recovery point; and redirecting a subsequent writerequest to said second memory location to a third memory location,thereby preserving the contents of said second memory location for asecond recovery point.
 2. The method of claim 1, further comprisingredirecting a read request to said first memory location to said secondmemory location, thereby returning the contents of said second memorylocation in response to said read request to said first memory location.3. The method of claim 1, further comprising redirecting a read requestto said second memory location to said third memory location, therebyreturning the contents of said third memory location in response to saidread request to said second memory location.
 4. The method of claim 1,wherein the memory is accessed via a network.
 5. The method of claim 1,wherein the memory is a disk drive and the memory states are sectorstates of the disk drive.
 6. The method of claim 5, wherein the diskdrive is accessed via a network.
 7. The method of claim 1, wherein saidprotected data contained in said first memory location is operatingsystem data of the computer system.
 8. The method of claim 1, whereinsaid first recovery point represents a configuration of the computersystem.
 9. The method of claim 1, wherein said first and second recoverypoints are configuration states, memory states, recovery states, sectorstates, or computer states.
 10. A method of storing a saved memory statein a computer system having a memory, the method comprising: selecting afirst addressable memory location as part of a first recovery point;receiving a write request to said first addressable memory location;redirecting said write request to a second addressable memory location;selecting said second addressable memory location as part of a secondrecovery point; and redirecting a subsequent write request to saidsecond addressable memory location to a third addressable memorylocation.
 11. The method of claim 10, further comprising redirecting aread request to said first addressable memory location to said secondaddressable memory location, thereby returning the contents of saidsecond addressable memory location in response to said read request tosaid first addressable memory location.
 12. The method of claim 10,further comprising redirecting a read request to said second addressablememory location to said third addressable memory location, therebyreturning the contents of said third addressable memory location inresponse to said read request to said second addressable memorylocation.
 13. The method of claim 10, further comprising creating saidsecond recovery point is in response to a timer event.
 14. The method ofclaim 10, further comprising creating said second recovery point is inresponse to satisfaction of a pre-determined condition.
 15. The methodof claim 10, wherein said first recovery point represents aconfiguration of the computer system.
 16. The method of claim 10,wherein said first and second recovery points are configuration states,memory states, recovery states, sector states, or computer states.
 17. Amethod of protecting a memory location from being overwritten, themethod comprising: creating a table of a status of at least one memorylocation; receiving a write request to a first memory location;determining if said first memory location contains protected data from astatus of said first memory location in said table; redirecting saidwrite request to a second memory location if said first memory locationcontains protected data; indicating a status of said second memorylocation in said table that said second memory location containsprotected data; redirecting a write request to said second memorylocation to a third memory location; and indicating a status of saidthird memory location in said table that said third memory locationcontains protected data.
 18. The method of claim 17, further comprisingredirecting a read request to said first memory location to said secondmemory location, thereby returning the contents of said second memorylocation in response to said read request to said first memory location.19. The method of claim 17, further comprising redirecting a readrequest to said second memory location to said third memory location,thereby returning the contents of said third memory location in responseto said read request to said second memory location.
 20. A method ofrestoring a computer system to a saved memory state, the methodcomprising: designating at least one memory location as recovery dataassociated with a first recovery point; redirecting write requests tosaid at least one memory location to another memory location; andrecovering to said first recovery point by designating said at least onememory location and said another memory location as recovery dataassociated with a second recovery point.
 21. The method of claim 20,wherein the memory locations are accessed via a network.
 22. The methodof claim 20, wherein the memory locations are locations on a disk drive.23. The method of claim 22, wherein the disk drive is accessed via anetwork.
 24. The method of claim 20, wherein said recovering to saidfirst recovery point is initiated by an enterprise manager executing ona remote computer system that is connected to the computer system via anetwork.
 25. The method of claim 20, wherein said recovering to saidfirst recovery point is in response to a timer event.
 26. The method ofclaim 20, wherein said recovering to said first recovery point is inresponse to satisfaction of a pre-determined condition.
 27. The methodof claim 20, wherein said first recovery point and said second recoverypoint comprise operating system data of the computer system.
 28. Themethod of claim 20, wherein said first recovery point represents aconfiguration of the computer system.
 29. The method of claim 20,wherein said first and second recovery points are configuration states,memory states, recovery states, sector states, or computer states. 30.The method of claim 20, further comprising: creating a virtual drivehaving user data files associated with said second recovery point; andcopying said user data files from said virtual drive to an activeoperating environment of the computer system.
 31. A computer operatingsystem configured to preserve protected memory locations that reside ona computer system and recover to a recovery point that represents asaved state of said protected memory locations, the computer operatingsystem comprising: a table containing data indicating the status ofprotected memory locations, wherein said table is initialized toindicate an original state of said protected memory locations; and adriver configured to: receive a write request to a first memorylocation; determine whether said first memory location is a protectedmemory location; if said first memory location is a protected memorylocation, find a second memory location that has a status of not used;update said table to indicate a used status of said second memorylocation; redirect said write request from said first memory location tosaid second memory location; and update said table to indicate aredirected status of said first memory location to said second memorylocation.
 32. The computer operating system of claim 31, wherein thedriver is further configured to redirect a read request to said firstmemory location to said second memory location, thereby returning thecontents of said second memory location in response to said read requestto said first memory location.
 33. The computer operating system ofclaim 31, wherein the driver is further configured to: receive a writerequest to said second memory location; determine whether said secondmemory location is a protected memory location; if said second memorylocation is a protected memory location, find a third memory locationthat has a status of unused; update said table to indicate a used statusof said third memory location; redirect said write request from saidsecond memory location to said third memory location; and update saidtable to indicate a redirected status of said second memory location tosaid third memory location.
 34. The computer operating system of claim33, wherein the driver is further configured to redirect a read requestto said second memory location to said third memory location, therebyreturning the contents of said third memory location in response to saidread request to said second memory location.
 35. The computer operatingsystem of claim 33, wherein the memory locations are accessed via anetwork.
 36. The computer operating system of claim 33, wherein thememory locations are locations on a disk drive.
 37. The computeroperating system of claim 36, wherein the disk drive is accessed via anetwork.
 38. The computer operating system of claim 33, wherein saidprotected memory locations contain operating system data of the computersystem.
 39. The computer operating system of claim 31, furthercomprising a module configured to create a virtual drive having userdata files associated with the recovery point.
 40. A method ofpreserving protected memory locations that reside on a computer systemand recovering to a recovery point that represents a saved state of saidprotected memory locations, the method comprising: initializing a tablecontaining data indicating the status of protected memory locations toindicate an original state of said protected memory locations; receivinga write request to a first memory location; determining whether saidfirst memory location is a protected memory location; if said firstmemory location is a protected memory location, finding a second memorylocation that has a status of not used; updating said table to indicatea used status of said second memory location; redirecting said writerequest from said first memory location to said second memory location;and updating said table to indicate a redirected status of said firstmemory location to said second memory location.
 41. The method of claim40, further comprising redirecting a read request to said first memorylocation to said second memory location, thereby returning the contentsof said second memory location in response to said read request to saidfirst memory location.
 42. The method of claim 40, further comprising:receiving a write request to said second memory location; determiningwhether said second memory location is a protected memory location; ifsaid second memory location is a protected memory location, finding athird memory location that has a status of unused; updating said tableto indicate a used status of said third memory location; redirectingsaid write request from said second memory location to said third memorylocation; and updating said table to indicate a redirected status ofsaid second memory location to said third memory location.
 43. Themethod of claim 40, further comprising redirecting a read request tosaid second memory location to said third memory location, therebyreturning the contents of said third memory location in response to saidread request to said second memory location.
 44. The method of claim 40,wherein the memory locations are accessed via a network.
 45. The methodof claim 40, wherein said protected memory location contains operatingsystem data of the computer system.
 46. A method of creating a pluralityof tables in a computer system having protected memory locations, saidplurality of tables representing a plurality of recovery points thatrepresent saved states of said protected memory locations, the methodcomprising: creating an initial table indicating an original state ofprotected memory locations, wherein said initial table is associatedwith an initial recovery point; identifying a new recovery pointrepresenting a new state of said protected memory locations to bepreserved; creating a new table corresponding to said new recoverypoint, wherein said new table is a copy of said initial table; comparingsaid new table to a most recently created previous table; and if saidnew table indicates an unused status for a memory location for which acorresponding memory location of said previous table indicates a usedstatus, updating said new table to indicate a status of protected forsaid memory location.
 47. The method of claim 46, wherein the memorylocations are accessed via a network.
 48. The method of claim 46,wherein the memory locations are locations on a disk drive.
 49. Themethod of claim 48, wherein the disk drive is accessed via a network.50. The method of claim 46, wherein said identifying the new recoverypoint is initiated by an enterprise manager executing on a remotecomputer system that is connected to the computer system via a network.51. The method of claim 46, wherein said identifying the new recoverypoint is in response to a timer event.
 52. The method of claim 46,wherein said identifying the new recovery point is in response tosatisfaction of a pre-determined condition.
 53. The method of claim 46,wherein said protected memory locations contain operating system data ofthe computer system.
 54. The method of claim 46, wherein said recoverypoints represent a configuration of the computer system.
 55. The methodof claim 46, wherein said recovery points are configuration states,memory states, recovery states, sector states, or computer states. 56.The method of claim 46, further comprising removing said initialrecovery point, wherein said removing comprises deleting the tableassociated with said initial recovery point.
 57. The method of claim 56,wherein said removing further comprises releasing memory locations ofthe deleted table and memory locations no longer needed after removal ofsaid initial recovery point, and wherein the released memory locationsare available for use by the computer system.
 58. The method of claim46, further comprising removing said new recovery point, wherein saidremoving comprises deleting the table corresponding to said new recoverypoint.
 59. A computer readable storage medium having stored thereoninstructions that when executed by a computer processor perform a methodof recovery to a saved memory state in a computer system having amemory, the method comprising: receiving a write request to a firstmemory location; determining whether said first memory location containsprotected data; redirecting said write request to a second memorylocation if said first memory location contains protected data, therebypreserving the contents of the first memory location for a firstrecovery; and redirecting a subsequent write request to said secondmemory location to a third memory location, thereby preserving thecontents of said second memory location for a second recovery.
 60. Thecomputer readable storage medium of claim 56, the method furthercomprising redirecting a read request to said first memory location tosaid second memory location, thereby returning the contents of saidsecond memory location in response to said read request to said firstmemory location.
 61. The method of claim 56, wherein said protected datacontained in said first memory location comprises operating system dataof the computer system.